WO2012159366A1

WO2012159366A1 - Data management method and device

Info

Publication number: WO2012159366A1
Application number: PCT/CN2011/077971
Authority: WO
Inventors: 王永宏; 李修奕; 张明; 周为民
Original assignee: 华为技术有限公司
Priority date: 2011-08-03
Filing date: 2011-08-03
Publication date: 2012-11-29
Also published as: US20140115697A1; CN103098502A

Abstract

The present invention relates to communication technologies, and disclosed are a data management method and device for solving the customer loss problem of the operators caused by the existing data management technology. The method includes: acquiring the operation identification code of a terminal and a preset terminal identification code (101), with the terminal identification code being unchangeable and corresponding to the terminal; performing hash operation on first data by way of a preset hash algorithm to obtain a first hash value (102); detecting whether or not the signature is consistent with the first hash value to obtain a detection result (103); and determining the right to use of the terminal according to the detection result (104). The present invention can be applied in mobile terminals such as mobile phones and so on.

Description

Data management method and device

The present invention relates to communication technologies, and in particular, to a data management method and apparatus.

Background technique

In the prior art, the security booting technology (secure boo t technology) can implement operator-to-terminal data management. The specific process of implementing the carrier-to-terminal data management by the secure boo t technology includes: generating an initial carrier identification code and a corresponding program image in the flash memory of the terminal according to the lock network requirement of the terminal; and based on the initial operation in the flash memory The merchant identification code and the program image generate a signature, and the signature is rewritable; when the terminal is started, the carrier identifier and the program image in the flash memory are hashed by a hash algorithm preset by the terminal to obtain a hash value; Detecting whether the signature is consistent with the hash value. If they are consistent, the initial carrier identifier of the program and the flash memory is not illegally changed; and the usage right of the terminal is determined according to the detection result.

When the above-mentioned secure boo t technology is used to implement the data management of the operator to the terminal, the inventor finds that the prior art has at least the following problems: The illegal user can use the program image of the terminal of the other operator customized with the same hardware configuration, and replace the terminal of the terminal. When the program image is difficult to be detected, the operator's customer is lost, causing the operator's loss.

Summary of the invention

The embodiment of the present invention provides a data management method and apparatus, which can detect that an illegal user replaces a program image of the terminal with a program image of a terminal customized by another operator having the same hardware configuration.

In one aspect, a data management method is provided, including: acquiring an operator identifier of the terminal and a preset terminal identifier, where the terminal identifier is unrewritable and corresponding to the terminal; The hash algorithm is configured to perform a hash operation on the first data to obtain a first hash value, where the first data includes the terminal identifier and the operator identifier; and the detected signature and the first hash value If the result is consistent, the detection result is obtained, the signature is pre-generated according to the terminal identification code and the initial operator identification code, and the initial operator identification code is pre-generated by the terminal; The usage rights of the terminal.

In another aspect, a data management apparatus is provided, including:

a data acquisition module, configured to acquire an operator identification code of the terminal and a preset terminal identification code, where the terminal identification code is not rewritable and corresponds to the terminal; a hash value obtaining module, configured to perform hashing on the first data by using a preset hash algorithm, to obtain a first hash value, where the first data includes a terminal identifier and a carrier acquired by the data acquiring module Identifier;

a first detecting module, configured to detect whether the signature is consistent with the first hash value obtained by the hash value obtaining module, and obtain a detection result, where the signature is pre-generated according to the terminal identifier and the initial carrier identifier The initial carrier identifier is pre-generated by the terminal;

The authority determining module is configured to determine the usage right of the terminal according to the detection result obtained by the first detecting module.

The data management method and device provided by the embodiment of the present invention obtains the first hash value by performing a hash operation including the terminal identification code and the operator identification code; and detecting whether the first hash value is consistent with the pre-generated signature And determining the usage rights of the terminal according to the detection result, thereby realizing data management of the terminal. Since the terminal identification code is not rewritable, it is difficult for an illegal user to replace the signature of the terminal with the signature of the terminal customized by another operator, and the program image of the terminal can be detected by replacing the program image with the program image. The embodiment of the present invention solves the problem that the illegal user can use the program image of the terminal customized by other operators with the same hardware configuration in the prior art, and replaces the program image of the terminal, causing the operator's customer to be lost and causing the loss of the operator. .

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any creative work.

1 is a flowchart of a data management method according to Embodiment 1 of the present invention;

2 is a flowchart of a data management method according to Embodiment 2 of the present invention;

3 is a flowchart of a data management method according to Embodiment 3 of the present invention;

4 is a schematic structural diagram 1 of a data management apparatus according to Embodiment 4 of the present invention;

FIG. 5 is a schematic structural diagram 2 of a data management apparatus according to Embodiment 4 of the present invention; FIG.

FIG. 6 is a schematic structural diagram 3 of a data management apparatus according to Embodiment 4 of the present invention.

detailed description

The technical solution in the embodiment of the present invention will be described below with reference to the accompanying drawings in the embodiments of the present invention. The invention is described in a clear and complete manner, and it is obvious that the described embodiments are only a part of the embodiments of the invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

In order to solve the problem that the existing data management leads to the loss of the operator's customers, the embodiment of the present invention provides a data management method and apparatus.

Step 101: Obtain an operator identifier of the terminal and a preset terminal identifier. In this embodiment, the operator identification code in step 101 is used to associate with an operator, including a Public Land Mobile Network (PLMN) identifier; it may be rewritable, and the carrier identifier may be passed. Establish an association with the operator. The operator identification code in step 101 may be related to the operator network; for different carrier networks, the carrier identification code is different. The carrier identification code may be a PLMN identification code or other identification code, and is not repeated here.

In this embodiment, the terminal identification code preset in step 101 is not rewritable and corresponds to the terminal. The terminal identification code is used to associate with the terminal in hardware; it can be set inside the chip of the terminal when the terminal is produced.

In this embodiment, the operator identification code may be obtained from the data card of the terminal through the step 101, or the carrier identification code may be obtained from the flash memory of the terminal, and is not described here. The data card of the terminal may be a Subscriber Identity Module (SIM), a Universal Subscriber Identity Module (USIM), or other types of user identification cards, which are not limited herein. .

Step 102: Perform a hash operation on the first data by using a preset hash algorithm to obtain a first hash value.

In this embodiment, the first data in step 102 may include a terminal identifier and an operator identifier, and may also include other content such as security data, which is not limited herein. The security data is data that prohibits other users from illegally modifying the tomb, and is used to perform functional restrictions on the terminal.

In this embodiment, the hashing process of the first data by using a preset hash algorithm in step 102 may be implemented by setting a code corresponding to the hash algorithm in the terminal, or may be implemented by other methods. No longer here - repeat.

Step 103: Check whether the signature is consistent with the first hash value, and obtain a detection result. In this embodiment, the signature in step 103 is pre-generated according to the terminal identifier and the initial operator identifier, and the initial operator identifier is pre-generated by the terminal. When the signature is in the form of a hash value, step 103 can directly detect whether the signature is consistent with the first hash value. When the signature is in the form of a hash-encrypted ciphertext, the signature needs to be decrypted first. Then, through step 103, it is detected whether the decrypted result is consistent with the first hash value.

Step 104: Determine, according to the detection result, the usage right of the terminal.

In this embodiment, when the detection result obtained by step 103 is that the signature is consistent with the first hash value, the terminal has the usage right; according to the detection result, the terminal can be used normally. When the detection result obtained in step 103 is that the signature is inconsistent with the first hash value, the terminal does not have the use permission; according to the detection result, the terminal runs the error handler and cannot be used normally.

The data management method provided by the embodiment of the present invention obtains the first hash value by performing a hash operation including the terminal identification code and the operator identification code; and detects whether the first hash value is consistent with the pre-generated signature, and The usage right of the terminal is determined according to the detection result, thereby realizing data management of the terminal. Since the terminal identification code is not rewritable, it is difficult for an illegal user to replace the signature of the terminal with the signature of the terminal customized by another operator, and the program image of the terminal can be detected by replacing the program image with the program image. The embodiment of the present invention solves the problem that the illegal user can use the program image of the terminal customized by other operators with the same hardware configuration in the prior art, and replaces the program image of the terminal, resulting in loss of the operator's customer and causing loss of the operator. .

As shown in FIG. 2, the data management method provided in Embodiment 2 of the present invention includes: Step 201: Generate an initial operator identification code in a flash memory of the terminal according to a lock requirement of the terminal.

In this embodiment, the terminal manufacturer can generate an initial carrier identification code in the flash memory of the terminal through step 201 when the terminal is produced. After the initial operator identification code is generated in the flash memory of the terminal through step 201, the terminal manufacturer or user can obtain the modified carrier identification code according to the initial carrier identification code.

Step 202: Generate a signature according to the second data.

In this embodiment, the signature is rewritable in the step 202, and the second data may include the initial carrier identifier and the terminal identifier, and may include other content such as security data, which is not limited herein. The process of generating a signature by step 202 may include adopting a preset The hash algorithm performs a hash operation on the second data, and the obtained second hash value is the signature; in order to improve the reliability of the signature, the second data may be hashed by a preset hash algorithm to obtain the first After the second hash value, the second hash value is encrypted, and the obtained ciphertext is the signature.

Step 203 to step 204: Obtain an operator identification code of the terminal and a preset terminal identification code, and perform hash operation on the first data by using a preset hash algorithm. For the specific process, reference may be made to step 101 to step 102 shown in FIG. 1, which is not repeated here.

Step 205: Check whether the signature is consistent with the first hash value, and obtain a detection result.

In this embodiment, if the signature is generated in step 205 according to the initial operator identification code and the terminal identification code, correspondingly, the first hash value is generated according to the operator identification code and the terminal identification code through step 204. If the signature is generated in step 205 according to the initial operator identification code, the terminal identification code, and the security data, correspondingly, the first hash value is determined by the operator according to the operator's identification of the 'J code, terminal identification. Code and security data generated.

In this embodiment, if the signature in step 205 is a second hash value obtained by hashing the second data by using a hash algorithm set in advance, it is detected in step 205 whether the signature is consistent with the first hash value. The process is: detecting whether the second hash value is consistent with the first hash value; if the signature in step 205 is to hash the second data by using a preset hash algorithm to obtain the second hash value, The second hash value is encrypted, and the obtained ciphertext is detected by step 205. The process of detecting whether the signature is consistent with the first hash value is: decrypting the signature to obtain a third hash value, and detecting the third hash value. Whether it is consistent with the first hash value, the detection result is obtained.

In this embodiment, when the public key corresponding to the private key encrypted by the second hash value is the public key in the root certificate, the signature can be directly decrypted by the public key of the root certificate; When the public key corresponding to the encrypted private key is the public key of the certificate in the flash memory of the terminal, in order to improve the security of the network communication, the public key of the certificate in the flash memory may be encrypted in advance to obtain the encrypted public key; The process of decrypting the signature may include: the terminal first decrypts the encrypted public key by using the public key in the root certificate to obtain the public key of the certificate in the flash memory; and then the terminal performs the signature on the public key of the certificate in the flash memory. Decrypt.

Step 206: Determine, according to the detection result, the usage right of the terminal. The specific process and Figure 1 Step 104 is similar, and is not repeated here.

As shown in FIG. 3, the data management method provided in Embodiment 3 of the present invention includes: Step 301: Check whether the operator identification code in the data card of the terminal is consistent with the operator identification code in the flash memory of the terminal.

In this embodiment, in order to prevent the user from modifying the operator identification code in the data card or the carrier identification code in the flash memory of the terminal, the operator identification code in the data card of the terminal and the operator identification in the flash memory of the terminal may be first detected in step 301. Whether the codes are consistent. When it is determined in step 301 that the operator identification code in the data card of the terminal is consistent with the carrier identification code in the flash memory of the terminal, the operator identification code and the terminal identification code may be obtained through step 302. Optionally, when the terminal is determined through step 301 When the carrier ID in the data card is inconsistent with the carrier ID in the flash memory of the terminal, the terminal can run an error handler and cannot be used normally.

Step 302: When the carrier identifier in the data card is consistent with the carrier identifier in the flash memory, obtain the operator identifier of the terminal and the terminal identifier set in advance. The specific process is similar to step 101 shown in Figure 1, and is not repeated here.

Step 303 to step 305, performing a hash operation on the first data, and after obtaining the first hash value, detecting whether the signature is consistent with the first hash value, and determining the usage right of the terminal according to the detection result. The specific process is similar to step 102 to step 104 shown in FIG. 1, and is not repeated here.

The data management method provided by the embodiment of the present invention obtains the first hash value by performing a hash operation including the terminal identification code and the operator identification code; and detects whether the first hash value is consistent with the pre-generated signature, and The usage right of the terminal is determined according to the detection result, thereby realizing data management of the terminal. Since the terminal identification code is not rewritable, it is difficult for illegal users to use The signature of the terminal customized by other operators replaces the signature of the terminal, and the program image of the terminal is replaced with the program image can be detected. The embodiment of the present invention solves the problem that the illegal user can use the program image of the terminal customized by other operators with the same hardware configuration in the prior art, and replaces the program image of the terminal, resulting in loss of the operator's customer and causing loss of the operator. .

As shown in FIG. 4, the data management apparatus provided in Embodiment 4 of the present invention includes: a data acquisition module 401, configured to acquire a carrier identifier of a terminal and a preset terminal identifier, where the terminal identifier is not rewritable and is connected to the terminal. --corresponding.

In this embodiment, the operator identification code in the data acquisition module 401 is used to associate with the operator, including the PLMN identification code; it may be rewritable, and the operator identification code may be used to establish an association with the operator. The operator identification code in the data acquisition module 401 can be related to the operator network; the carrier identifier is different for different carrier networks. The carrier identification code may be a PLMN identification code or other identification code, and is no longer referred to herein.

In this embodiment, the terminal identification code preset in the data acquisition module 401 is not rewritable and corresponds to the terminal. The terminal identification code is used to associate with the terminal in hardware; it can be set inside the chip of the terminal when the terminal is produced.

In this embodiment, the data acquisition module 401 can obtain the operator identification code from the data card of the terminal, or obtain the carrier identification code from the flash memory of the terminal, which is not repeated here. The data card of the terminal may be a SIM, a USIM, or another type of user identification card, which is not limited herein.

The hash value obtaining module 402 is configured to perform hashing on the first data by using a preset hash algorithm to obtain a first hash value, where the first data includes a terminal identifier and a carrier identifier obtained by the data acquiring module.

In this embodiment, the first data in the hash value obtaining module 402 may include the terminal identification code and the operator identification code, and may also include other content such as security data, which is not limited herein. The security data is data that prohibits other users from illegally modifying the tomb, and is used to limit the functionality of the terminal.

In this embodiment, the hash value obtaining module 402 performs a hash operation process on the first data by using a preset hash algorithm, which may be implemented by setting a code corresponding to the hash algorithm in the terminal, or may be Other ways to achieve, no longer here - repeat. The first detecting module 403 is configured to detect whether the signature is consistent with the first hash value obtained by the hash value obtaining module, and obtain a detection result, where the signature is pre-generated according to the terminal identifier and the initial operator identifier, and the initial operator identifier is generated. The code is pre-generated by the terminal.

In this embodiment, the signature in the first detection module 403 is pre-generated according to the terminal identification code and the initial operator identification code, and the initial carrier identification code is pre-generated by the terminal. When the signature is in the form of a hash value, the first detection module 403 can directly detect whether the signature is consistent with the first hash value. When the signature is in the ciphertext encrypted by the hash value, the signature needs to be first. Decryption is performed, and then the first detection module 403 detects whether the decrypted result is consistent with the first hash value.

The permission determining module 404 is configured to determine the usage right of the terminal according to the detection result obtained by the first detecting module.

In this embodiment, the rights determination module 404 can include a first determination sub-module and a second determination sub-module. The first determining submodule is configured to: when the detection result obtained by the first detecting module is that the signature is consistent with the first hash value, the terminal has the use permission; that is, the terminal can be used normally according to the detection result; the second determining submodule When the detection result obtained by the first detection module is that the signature is inconsistent with the first hash value, the terminal does not have the use permission; that is, according to the detection result, the terminal runs the error processing program and cannot be used normally.

Further, as shown in FIG. 5, the data management apparatus in this embodiment may further include: a number generation module 405, configured to generate an initial carrier identifier in the flash memory of the terminal according to the network lock requirement of the terminal.

In this embodiment, the terminal manufacturer can generate an initial carrier identification code in the flash memory of the terminal by the number generation module 405 when the terminal is produced. After the initial operator identification code is generated by the number generation module 405 in the flash memory of the terminal, the terminal manufacturer or user can obtain the modified carrier identification code according to the initial carrier identification code.

The signature generation module 406 is configured to generate a signature according to the second data, the signature is rewritable, and the second data includes an initial operator identifier generated by the number generation module and a terminal identifier.

In this embodiment, the signature in the signature generation module 406 is rewritable, and the second data may include an initial carrier identifier and a terminal identifier, and may include other content such as security data, which is not limited herein. The process of generating a signature by the signature generation module 406 may include performing a hash operation on the second data by using a preset hash algorithm to obtain a second hash value. For the signature, in order to improve the reliability of the signature, the hash data may be hashed by a preset hash algorithm to obtain a second hash value, and then the second hash value is encrypted. The ciphertext is the signature.

In this embodiment, if the signature in the first detection module 403 is generated according to the initial operator identification code and the terminal identification code through step 202, correspondingly, the first hash value is obtained by the hash value acquisition module 402 according to the operator. The identification code and the terminal identification code are generated; if the signature in the first detection module 403 is generated by the signature generation module 406 according to the initial carrier identification code, the terminal identification code, and the security data, correspondingly, the first hash value is passed through The hash value acquisition module 402 is generated based on the operator identification code, the terminal identification code, and the security data.

In this embodiment, if the signature in the first detecting module 403 is a hashing operation on the second data by using a hash algorithm set in advance, the second hash value obtained by the first detecting module 403 is detected by the first detecting module 403. Whether the hash value is consistent is: detecting whether the second hash value is consistent with the first hash value; if the signature in the first detecting module 403 is to hash the second data by using a preset hash algorithm, After the second hash value is obtained, the second hash value is encrypted, and the obtained ciphertext is detected by the first detecting module 403. The process of detecting whether the signature is consistent with the first hash value is: decrypting the signature to obtain the first hash value. The third hash value is detected whether the third hash value is consistent with the first hash value, and the detection result is obtained. At this time, the first detecting module 403 includes: a decrypting submodule, configured to decrypt the signature to obtain the first hash value. a three-hash value; a detection sub-module, configured to detect whether the third hash value is consistent with the first hash value, and obtain a detection result.

Further, as shown in FIG. 6, the data management apparatus in this embodiment may further include: a second detecting module 400, configured to detect whether the carrier identifier in the data card of the terminal is consistent with the carrier identifier in the flash memory of the terminal. .

In this embodiment, in order to prevent the user from modifying the carrier identification code or the terminal in the data card The carrier identification code in the flash memory may first detect, by the second detection module 400, whether the operator identification code in the data card of the terminal is consistent with the carrier identification code in the flash memory of the terminal. When the second identification module 400 determines that the operator identification code in the data card of the terminal is consistent with the carrier identification code in the flash memory of the terminal, the operator identification code and the terminal identification code may be acquired by the data acquisition module 401; When the second detection module 400 determines that the operator identification code in the data card of the terminal is inconsistent with the carrier identification code in the flash memory of the terminal, the terminal can run an error handling program and cannot be used normally.

At this time, the data obtaining module 401 is specifically configured to acquire the operator identifier of the terminal and the preset terminal identifier when the operator identifier in the data card is consistent with the carrier identifier in the flash.

The data management apparatus provided by the embodiment of the present invention obtains the first hash value by performing a hash operation including the terminal identification code and the operator identification code, and detects whether the first hash value is consistent with the pre-generated signature, and The usage right of the terminal is determined according to the detection result, thereby realizing data management of the terminal. Since the terminal identification code is not rewritable, it is difficult for an illegal user to replace the signature of the terminal with the signature of the terminal customized by another operator, and the program image of the terminal can be detected by replacing the program image with the program image. The embodiment of the present invention solves the problem that the illegal user can use the program image of the terminal customized by other operators with the same hardware configuration in the prior art, and replaces the program image of the terminal, resulting in loss of the operator's customer and causing loss of the operator. .

The data management method and apparatus provided by the embodiments of the present invention can be applied to mobile terminals such as mobile phones.

The steps of a method or algorithm described in connection with the embodiments disclosed herein can be implemented directly in hardware, a software module executed by a processor, or a combination of both. The software module can be placed in random access memory (RAM), memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or technical field. Any other form of storage medium known.

The above is only a specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Claims

Claim

A data management method, characterized in that it comprises:

Acquiring an operator identification code of the terminal and a preset terminal identification code, where the terminal identification code is not rewritable and corresponds to the terminal;

Performing a hash operation on the first data by using a hash algorithm that is preset to obtain a first hash value, where the first data includes the terminal identifier and the carrier identifier;

Detecting whether the signature is consistent with the first hash value, and obtaining a detection result, where the signature is pre-generated according to the terminal identifier and the initial operator identifier, and the initial operator identifier is pre-generated by the terminal. of;

Determining the usage right of the terminal according to the detection result.

The data management method according to claim 1, wherein before the acquiring the operator identification code of the terminal and the preset terminal identification code, the method further includes:

Generating the initial carrier identification code in a flash memory of the terminal according to a lock network requirement of the terminal;

Generating the signature according to the second data, the signature is rewritable, and the second data includes the initial operator identification code and the terminal identification code.

3. The data management method according to claim 2, wherein

The signature is: the second hash value obtained by hashing the second data by the preset hash algorithm; or

The signature is: a ciphertext obtained by performing a hash operation on the second data by using the preset hash algorithm to obtain the second hash value, and encrypting the second hash value.

Detecting whether the operator identification code in the data card of the terminal is consistent with the carrier identifier in the flash memory of the terminal;

The obtaining the operator identification code of the terminal and the preset terminal identification code is specifically: when the operator identification code in the data card is consistent with the operator identification code in the flash memory, acquiring the operator identification of the terminal The code and the preset terminal identification code.

The data management method according to claim 1, wherein the detecting signature is consistent with the first hash value, and the method includes: Decrypting the signature to obtain a third hash value;

Detecting whether the third hash value is consistent with the first hash value.

6. The data management method according to claim 1, wherein:

The terminal identifier is used to associate with the terminal in hardware;

The carrier identification code is used to associate with an operator, including a public land mobile network PLMN identification code.

The data management method according to claim 1, wherein the determining the usage right of the terminal according to the detection result comprises:

When the detection result is that the signature is consistent with the first hash value, the terminal has a usage right;

If the detection result is that the signature does not match the first hash value, the terminal does not have a usage right.

The data management method according to any one of claims 1 to 7, wherein the first data further comprises: security data, the second data further comprising: security data, wherein the security data is Data for illegal tombs modification by other users is prohibited, and is used to perform functional restrictions on the terminal.

9. A data management device, comprising:

a data acquisition module, configured to acquire an operator identification code of the terminal and a preset terminal identification code, where the terminal identification code is not rewritable and corresponds to the terminal;

a hash value obtaining module, configured to perform hashing on the first data by using a preset hash algorithm, to obtain a first hash value, where the first data includes a terminal identifier and a carrier acquired by the data acquiring module Identifier;

The data management apparatus according to claim 9, further comprising: a number generating module, configured to generate the initial carrier identifier in a flash memory of the terminal according to a lock requirement of the terminal ;

a signature generating module, configured to generate the signature according to the second data, where the signature is rewritable, The second data includes an initial operator identification code generated by the number generation module and the terminal identification code.

The data management device according to claim 9, further comprising: a second detecting module, configured to detect an operator identification code in the data card of the terminal and an operator identification code in the flash memory of the terminal Consistent;

And the data obtaining module is configured to obtain an operator identifier of the terminal and a preset terminal identifier when the operator identifier in the data card is consistent with the operator identifier in the flash memory.

The data management device according to claim 9, wherein the first detection module comprises:

a decryption submodule, configured to decrypt the signature to obtain a third hash value;

And a detecting submodule, configured to detect whether the third hash value is consistent with the first hash value, to obtain the detection result.

13. The data management device according to claim 9, wherein:

The terminal identifier is used to associate with the terminal in hardware;

The carrier identification code is used to associate with the operator, including a public land mobile network PLMN identity.

The data management apparatus according to claim 9, wherein the authority determining module comprises:

a first determining submodule, where the detection result obtained by the first detecting module is that the signature is consistent with the first hash value, the terminal has a usage right;

a second determining submodule, configured to: when the detection result obtained by the first detecting module is that the signature is inconsistent with the first hash value, the terminal does not have a usage right.

The data management device according to any one of claims 9 to 14, wherein the first data further comprises: security data, the second data further comprising: security data, wherein the security data is Data for illegal tombs modification by other users is prohibited, and is used to perform functional restrictions on the terminal.